We experimented with this process as a defense mechanism by selecting the smallest trained noise value \(\sigma =0.01\)  and using the Langevin process as a method to purify adversaries. We evaluated this method using our BPDA+EOT attack framework over different numbers of Langevin steps during purification. In contrast to reports from [1]}, we were unable to obtain any significant defense using a pretrained score model when initializing sampling directly from adversarial or natural images. In Figure REF , one can see that the score-based model drives natural images toward saturation quickly, leading to a sharp decrease in natural classification that undermines the possibility of robustness from sampling. The misaligned steady-state of the score-based models prevents it from being an a defensive transformation because natural accuracy drops before robustness kicks in. Since the score-based model does not perform sampling during training, and one cannot adjust the stability of its sampling process as we do in this work. While it is not immediately clear how to overcome this problem, we believe that defense with a score model is possible and we hope that our observation lead to efforts to stabilize the sampling paths of score models as we do for EBMs in this work.
<FIGURE>